Siemens SIMATIC and SCALANCE Products Encryption Strength (CVE-2023-0286)

high Tenable OT Security Plugin ID 501841

Synopsis

The remote OT asset is affected by a vulnerability.

Description

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:
- CVE-2023-0286: Disable CRL (certification revocation list) checking, if possible.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens' operational guidelines for Industrial Security. Additional information on Siemens Industrial Security can be found here.

For more information, see the associated Siemens security advisory SSA-203374 in HTML and CSAF.

Plugin Details

Severity: High

ID: 501841

Version: 1.4

Type: remote

Family: Tenable.ot

Published: 12/19/2023

Updated: 9/4/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.0

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:C

CVSS Score Source: CVE-2023-0286

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:siemens:scalance_w1750d_firmware, cpe:/o:siemens:siplus_et_200sp_cp_1543sp-1_isec_firmware, cpe:/o:siemens:simatic_drive_controller_cpu_1504d_tf_firmware:3.0.3, cpe:/o:siemens:simatic_s7-1500_firmware:2.9.7, cpe:/o:siemens:simatic_drive_controller_cpu_1504d_tf_firmware:2.9.7, cpe:/o:siemens:simatic_s7-1200_firmware:-, cpe:/o:siemens:siplus_et_200sp_cp_1543sp-1_isec_tx_rail_firmware, cpe:/o:siemens:simatic_et_200sp_open_controller_cpu_1515sp_pc2_firmware:21.9.7, cpe:/o:siemens:simatic_et_200sp_open_controller_cpu_1515sp_pc2_firmware:30.0.0, cpe:/o:siemens:scalance_xm408-4c_firmware, cpe:/o:siemens:scalance_xr526-8c_firmware, cpe:/o:siemens:simatic_et200sp_firmware:2.9.7, cpe:/o:siemens:scalance_xr552-12m_firmware, cpe:/o:siemens:siplus_et_200sp_cp_1542sp-1_irc_tx_rail_firmware, cpe:/o:siemens:simatic_s7-1500_tm_mfp, cpe:/o:siemens:scalance_xr528-6m_firmware, cpe:/o:siemens:simatic_s7-1500_firmware:3.0.3, cpe:/o:siemens:simatic_drive_controller_cpu_1507d_tf_firmware:3.0.3, cpe:/o:siemens:scalance_xm416-4c_firmware, cpe:/o:siemens:simatic_s7-1500_firmware:3.1.0, cpe:/o:siemens:scalance_xr524-8c_firmware, cpe:/o:siemens:simatic_cp_1542sp-1_firmware, cpe:/o:siemens:simatic_drive_controller_cpu_1507d_tf_firmware:2.9.7, cpe:/o:siemens:simatic_et200pro_firmware:2.9.7, cpe:/o:siemens:scalance_xm408-8c_firmware, cpe:/o:siemens:simatic_cp_1543sp-1_firmware, cpe:/o:siemens:simatic_cp_1542sp-1_irc_firmware, cpe:/o:siemens:simatic_s7-1500_firmware:-

Required KB Items: Tenable.ot/Siemens

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 3/14/2023

Reference Information

CVE: CVE-2023-0286

CWE: 20

ICSA: 23-075-04, 24-165-10, 24-165-11

Detections

Analytics